Recherche avancée

Sur d’autres sites (4717)

• Running Windows XP In 2016

  2 janvier 2016, par Multimedia Mike

  I have an interest in getting a 32-bit Windows XP machine up and running. I have a really good yet slightly dated and discarded computer that seemed like a good candidate for dedicating to this task. So the question is : Can Windows XP still be installed from scratch on a computer, activated, and used in 2016 ? I wasn’t quite sure since I have heard stories about how Microsoft has formally ended support for Windows XP as of the first half of 2014 and I wasn’t entirely sure what that meant.

  Spoiler : It’s still possible to install and activate Windows XP as of the writing of this post. It’s also possible to download and install all the updates published up until support ended.

  The Candidate Computer
  This computer was assembled either in late 2008 or early 2009. It was a beast at the time.

  
  
  Click for a larger image
  

  It was built around the newly-released NVIDIA GTX 280 video card. The case is a Thermaltake DH-101, which is a home theater PC thing. The motherboard is an Asus P5N32-SLI Premium with a Core 2 Duo X6800 2.93 GHz CPU on board. 2 GB of RAM and a 1.5 TB hard drive are also present.

  The original owner handed it off to me because their family didn’t have much use for it anymore (too many other machines in the house). Plus it was really, obnoxiously loud. The noisy culprit was the stock blue fan that came packaged with the Intel processor (seen in the photo) whining at around 65 dB. I replaced the fan and brought the noise level way down.

  As for connectivity, the motherboard has dual gigabit NICs (of 2 different chipsets for some reason) and onboard wireless 802.11g. I couldn’t make the latter work and this project was taking place a significant distance from my wired network. Instead, I connected a USB 802.11ac dongle and antenna which is advertised to work in both Windows XP and Linux. It works great under Windows XP. Meanwhile, making the adapter work under Linux provided a retro-computing adventure in which I had to modify C code to make the driver work.

  So, score 1 for Windows XP over Linux here.

  The Simple Joy of Retro-computing
  One thing you have to watch out for when you get into retro-computing is fighting the urge to rant about the good old days of computing. Most long-time computer users have a good understanding of the frustration that computers keep getting faster by orders of magnitude and yet using them somehow feels slower and slower over successive software generations.
  

  This really hits home when you get old software running, especially on high-end hardware (relative to what was standard contemporary hardware). After I got this new Windows XP machine running, as usual, I was left wondering why software was so much faster a few generations ago.

  Of course, as mentioned, it helps when you get to run old software on hardware that would have been unthinkably high end at the software’s release. Apparently, the minimum WinXP specs as set by MS are a 233 MHz Pentium CPU and 64 MB of RAM, with 1.5 GB of hard drive space. This machine has more than 10x the clock speed (and 2 CPUs), 32x the RAM, and 1000x the HD space. Further, I’m pretty sure 100 Mbit ethernet was the standard consumer gear in 2001 while 802.11b wireless was gaining traction. The 802.11ac adapter makes networking quite pleasant.

  Purpose
  Retro-computing really seems to be ramping up in popularity lately. For some reason, I feel compelled to declare at this juncture that I was into it before it was cool.

  Why am I doing this ? I have a huge collection of old DOS/Windows computer games. I also have this nerdy obsession with documenting old video games in the MobyGames database. I used to do a lot of this a few years ago, tracking the effort on my gaming blog. In the intervening years, I have still collected a lot of old, unused, unloved video games, usually either free or very cheap while documenting my collection efforts on that same blog.

  So I want to work my way through some of this backlog, particularly the games that are not yet represented in the MobyGames database, and even more pressing, ones that the internet (viewed through Google at least) does not seem to know about. To that end, I thought this was a good excuse to get Windows XP on this old machine. A 32-bit Windows XP machine is capable of running any software advertised as supporting Windows XP, Windows ME, Windows 98, Windows 95, and even 16-bit Windows 3.x (I have games for all these systems). That covers a significant chunk of PC history. It can probably be made to run DOS games as well, but those are (usually) better run under DosBox. In order to get the right display feel, I even invested in a (used) monitor sporting a 4:3 aspect ratio. If I know these old games, most will be engineered and optimized for that ratio rather than the widescreen resolutions seen nowadays.

  I would also like to get back to that Xbox optical disc experimentation I was working on a few years ago. Another nice feature of this motherboard is that it still provides a 40-pin IDE/PATA adapter which makes the machine useful for continuing that old investigation (and explains why I have that long IDE cable to no where pictured hanging off the board).

  The Messy Details
  I did the entire installation process twice. The first time was a bumbling journey of discovery and copious note-taking. I still have Windows XP installation media that includes service pack 2 (SP2), along with 2 separate licenses that haven’t been activated for a long time. My plan was to install it fresh, then install the relevant drivers. Then I would investigate the Windows update and activation issues and everything should be fine.

  So what’s the deal with Windows Update for XP, and with activations ? Second item first : it IS possible to still activate Windows XP. The servers are still alive and respond quickly. However, as always, you don’t activate until you’re sure everything is working at some baseline. It took awhile to get there.

  As for whether Windows Update still works for XP, that’s a tougher question. Short answer is yes ; longer answer is that it can be difficult to kick off the update process. At least on SP2, the “Windows Update” program launches IE6 and navigates to a special microsoft.com URL which initiates the update process (starting with an ActiveX control). This URL no longer exists.

  From what I can piece together from my notes, this seems to be the route I eventually took :

  1. Install Windows XP fresh
  2. Install drivers for the hardware ; fortunately, Asus still has all the latest drivers necessary for the motherboard and its components but it’s necessary to download these from another network-connected PC since the networking probably won’t be running “out of the box”
  3. Download the .NET 3.5 runtime, which is the last one supported by Windows XP, and install it
  4. Download the latest NVIDIA drivers ; this needs to be done after the previous step because the installer requires the .NET runtime ; run the driver installer and don’t try to understand why it insists on re-downloading .NET 3.5 runtime before installation
  5. While you’re downloading stuff on other computers to be transported to this new machine, be sure to download either Chrome or Firefox per your preference ; if you try to download via IE6, you may find that their download pages aren’t compatible with IE6
  6. Somewhere along the line (I’m guessing as a side effect of the .NET 3.5 installation), the proper, non-IE6-based Windows Update program magically springs to life ; once this happens, there will be 144 updates (in my case anyway) ; installing these will probably require multiple reboots, but SP3 and all known pre-deprecation security fixes will be installed
  7. Expect that, even after installing all of these, a few more updates will appear ; eventually, you’ll be at the end of the update road
  8. Once you’re satisfied everything is working satisfactorily, take the plunge and activate your installation

  Residual Quirks
  Steam runs great on Windows XP, as do numerous games I have purchased through the service. So that opens up a whole bunch more games that I could play on this machine. Steam’s installer highlights a curious legacy problem of Windows XP– it seems there are many languages that it does not support “out of the box” :

  
  
  

  It looks like the Chinese options and a few others that are standard now weren’t standard 15 years ago.

  Also, a little while after booting up, I’ll get a crashing error concerning a process called geoforms.scr. This appears to be NVIDIA-related. However, I don’t notice anything obviously operationally wrong with the system.

  Regarding DirectX support, DirectX 9 is the highest version officially supported by Windows XP. There are allegedly methods to get DirectX 10 running as well, but I don’t care that much. I did care, briefly, when I realized that a bunch of the demos for the NVIDIA GTX 280 required DX10 which left me wondering why it was possible to install them on Windows XP.

  Eventually, by installing enough of these old games, I fully expect to have numerous versions of .NET, DirectX, QT, and Video for Windows installed side by side.

  Out of curiosity, I tried playing a YouTube HD/1080p video. I wanted to see if the video was accelerated through my card. The video played at full speed but I noticed some tearing. Then I inspected the CPU usage and noticed that the CPU was quite loaded. So either the GTX 280 doesn’t have video acceleration, or Windows XP doesn’t provide the right APIs, or Chrome is not able to access the APIs in Windows XP, or perhaps some combination of the foregoing.

  Games are working well, though. I tried one of my favorite casual games and got sucked into that for, like, an entire night because that’s what casual games do. But then, I booted up a copy of WarCraft III that I procured sometime ago. I don’t have any experience with the WarCraft universe (RTS or MMO) but I developed a keen interest in StarCraft II over the past few years and wanted to try WarCraft III. Unfortunately, I couldn’t get WarCraft III to work correctly on several different Windows 7 installations (movies didn’t play, which left me slightly confused as to what I was supposed to do).

  Still works beautifully on the new old Windows XP machine.

  The post Running Windows XP In 2016 first appeared on Breaking Eggs And Making Omelettes.

• The Guide to an Ethical Web : With Big Data Comes Big Responsibility

  13 mars, par Alex Carmona

  Roughly two-thirds of Earth’s 8 billion people use the internet for communication, education, entertainment, business and more. We are connected globally in ways previous generations could’ve never dreamed of. It’s been a wild ride, and we’re just starting.

  Many users have learned that experiences online can be a mix of good and bad. Sometimes, the bad can feel like it outweighs the good, particularly when large tech companies use our data shadily, cut corners on accessibility or act in any other way that devalues the human being behind the screen.

  As fellow internet citizens, what responsibility do we have to create a more ethical web for our customers ?

  In this article, we’ll look at ethical principles online and how to act (and not act) to build trust, reach customers regardless of ability, safeguard privacy and stay compliant while improving business outcomes.

  

  What is an “ethical web” ?

  When we talk about the ethical web, we’re talking about the use of the internet in an ethical way. Among other values, it involves transparency, consent and restraint. It applies the Golden Rule to the internet : Treat others (and their data and user experience) how you’d want yourself (and yours) to be treated. 

  With limited oversight, the internet has evolved in ways that often prioritise profit over user rights. While selling data or pushing cookies might seem logical in this context, they can undermine trust and reputation. And the tide is slowly but surely shifting as consumers and legislators push back.

  Consumers no longer want to buy from companies that will use their data in ways they don’t agree to. In 2022, 75% of UK and US consumers surveyed said they were uncomfortable purchasing from businesses with weak data ethics.

  Legislators worldwide have been taking part in this effort for nearly a decade, with laws like GDPR in the EU and LGPD in Brazil, as well as the various state laws in the US, like California’s CCPA and Virginia’s VCDPA. 

  Even tech giants are no longer above the law, like Meta, which was fined over a billion Euros for GDPR violations in 2023.

  

  These changes may make the internet feel less business-friendly at first glance, but ethical choices ultimately build a stronger digital ecosystem for both companies and consumers. 

  Likewise, all internet users alike can make this happen by shunning short-term profit and convenience for healthier, long-term choices and behaviour.

  As we dig into what it takes to build an ethical web, remember that no company or individual is free from mistakes in these areas nor is it an overnight fix. Progress is made one click at a time.

  Ethical SEO : Optimising your content and your ethics

  Content creation and search engine optimisation (SEO) require so much work that it’s hard to fault creators for not always abiding by search engine guidelines and seeking shortcuts – especially when there’s a sea of LinkedIn posts about how copying/pasting ChatGPT responses helped someone rank #1 for several keywords in one week.

  However, users turn to Google and other search engines for something of substance that will guide or entertain them.

  Content meets customer needs and is more likely to lead to sales when it’s well-written, original and optimised just enough to make it easier to find on the first page of results. This doesn’t happen when content teams dilute quality and waste a reader or viewer’s time on posts that will only yield a higher bounce rate.

  Some SEO pros do find success by building backlinks through private blog networks or crafting a million unedited posts with generative AI, but it’s short-lived. Google and other search engines always catch up, and their content plummets or gets penalised and delisted with every new update.

  Content teams can still rank at the top while sticking to ethical SEO principles. Here’s a sample list of dos and don’ts to get started :

  • Do put content quality above all else. Make content that serves the audience, not just a brand or partner ad network.
  • Do apply the E-E-A-T framework. Search engines value content written by authors who bring expertise, experience, authority and trust (E-E-A-T).
  • Don’t keyword stuff. This might have worked in the early days of SEO, but it hurts readability and now harms article performance.
  • Do use alt text as intended. While it can still help SEO, alt text should prioritise accessibility for users with screen readers.

  • Don’t steal content. Whether it’s violating copyright, copying/pasting other people’s content or simply paraphrasing without citation, companies should never steal content.
  • Don’t steal ideas. It’s okay to join in on a current conversation or trends in an industry, but content creators should be sure they have something valuable to add.
  • Do use AI tools as partners, not creators. AI can be an incredible aid in crafting content, but it should never be posted without a human’s touch.

  When we follow ethical SEO guidelines and get more clients with our content, how do we best handle their data ?

  Ethical data governance : Important principles and how to avoid data misuse

  Data governance comprises every aspect of how a company manages data, including storage, security, privacy, lifecycle management, setting policies and maintaining compliance with laws like GDPR and HIPAA.

  Applying data ethics to governance is doing it all in a transparent, restrained way that acknowledges an individual’s right to ownership over their data. 

  For organisations, this translates to getting consent to collect data and clearly spelling out how it will be stored and used — and sticking to it.

  If a user’s birth date is needed for legal reasons, it cannot be sold to a third party or later used for something else without explicit permission. Reusing data in ways that stray from its original purpose is a form of commingling, one of the data misuses that is easy for even well-intentioned teams to do accidentally.

  Ethical data governance also includes the vigilant safeguarding of users’ data and minimising potential privacy issues.

  Failing to implement and adhere to strong security measures leads to situations like the National Public Data (NPD) breach, where cyber criminals expose the addresses, phone numbers and social security numbers of hundreds of millions of people. This was due in large part to a weakness in storing login credentials and a lack of password policy enforcement.

  No one at NPD wanted this to happen, but security likely took a backseat to other business concerns, leading to the company’s filing for bankruptcy.

  More importantly, as a data broker that aggregates information from other sources, the people affected likely had no clue this organisation had been buying and selling their data. The companies originally entrusted with their information helped provide the leaked data, showing a lack of care for privacy.

  Situations like this reinforce the need for strict data protection laws and for companies to refine their data governance approach. 

  Businesses can improve their data governance posturing with managers and other higher-ups setting the right tone at the top. If leadership takes a firm and disciplined approach by setting and adhering to strong policies, the rest of the team will follow and minimise the chances of data misuse and security incidents.

  One way to start is by using tools that make the principles of data ethics easier to follow.

  Ethical web analytics : Drawing insights while respecting privacy

  Web analytics tools are designed to gather data about users and what they do while visiting a site.
  The most popular tool worldwide is Google Analytics (GA). Its brand name and feature set carry a lot of weight, but many former users have switched to alternatives due to dissatisfaction with the changes made in GA4 and reservations about the way Google handles data.

  

  Google is another tech giant that has been slapped with massive GDPR fines for issues over its data processing practices. It has run so afoul of compliance that it was banned in France and Austria for a while. Additionally, in the US Department of Justice’s ongoing antitrust lawsuit against Google, the company’s data tracking has been targeted for both how it affects users and potential rivals.

  Unlike GA, ethical web analytics tools allow websites to get the data they need while respecting user privacy.

  Matomo offers privacy protections like :

  • Providing data anonymisation and IP anonymisation
  • Allowing users the ability to not process personally identifiable information (PII)
  • Disabling the ability to track users across websites by default to make compliance easier
  • Giving users full control over their customer data without the risk of it getting into the hands of third parties
  • Much more

  We’re also fully transparent about how we handle your data on the web and in the Matomo Cloud and in how we build Matomo as an open-source tool. Our openness allows you to be more open with your customers and how you ethically use their data.

  There are other GDPR-compliant tools on the market, but some of them, like Adobe Analytics, require more setup from users for compliance, don’t grant full control over data and don’t offer on-premise options or consent-free tracking.

  Beyond tracking, there are other ways to make a user’s experience more enjoyable and ethical.

  Ethical user experience : User-friendliness, not user-hostility

  When designing a website or application, creating a positive user experience (UX) always comes first. 

  The UI should be simple to navigate, data and privacy policy information should be easy to find and customers should feel welcomed. They must never be tricked into consenting or installing. 

  When businesses resort to user-hostile tactics, the UX becomes a battle between the user and them. What may seem like a clever tactic to increase sign-ups can alienate potential customers and ruin a brand’s image. 

  Here are some best practices for creating a more ethical UX :

  Avoid dark patterns

  Dark patterns are UI designs and strategies that mislead users into paying for, agreeing to or doing something they don’t actually want. These designs are unethical because they’re manipulative and remove transparency and consent from the interaction. 

  In some cases, they’re illegal and can bring lawsuits. 

  In 2023, Italy’s Data Protection Authority (DPA) fined a digital marketing company €300,000 for alleged GDPR violations. They employed dark patterns by asking customers to accept cookies again after rejecting them and placing the option to reject cookies outside the cookie banner. 

  Despite their legality and 56% of surveyed customers losing trust in platforms that employ dark patterns, a review by the Organisation for Economic Co-operation and Development (OECD) found that 76% of the websites examined contained at least one dark pattern.

  

  If a company is worried that they may be relying on dark patterns, here are some examples of what to avoid :

  • Pre-ticking boxes to have users agree to third-party cookies, sign up for a newsletter, etc.
  • Complicated cookie banners without a one-click way to reject all unnecessary cookies
  • Hiding important text with text colour, under drop-down menus or requiring hovering over something with a mouse 
  • “Confirm shaming” users with emotionally manipulative language to delay subscription cancellations or opt out of tracking 

  Improve trust centres

  Trust centres are the sections of a website that outline how a company approaches topics like data governance, user privacy and security. 

  They should be easy to find and understand. If a user has a question about a company’s data policy, it should be one click away with language that doesn’t require a law degree to comprehend.

  Additionally, trust centres must cover all relevant details, including where data is stored and who does the subprocessing. This is an area where even some of the best-intentioned companies may miss the mark, but it’s also an easy fix and a great place to start creating a more ethical web.

  Embrace inclusivity

  People want to feel welcomed to the party — and deserve to be — regardless of their race, ethnicity, religion, gender identity, orientation or ability. 

  Inclusivity is great for customers and companies alike. 

  A study by the Unstereotype Alliance found that progressive marketing drove up short- and long-term sales, customer loyalty and purchase consideration. A Kantar study reported that 75% of surveyed customers around the world consider a company’s diversity and inclusivity when making a purchasing decision.

  An easy place to start embracing inclusivity is with a website’s blog images. The people in photos and cartoons should reflect a variety of different backgrounds.

  Another area to improve inclusivity is by making your site or app more accessible.

  Accessibility ethics : An internet for everyone

  Accessibility is designing your product in a way that everyone can enjoy or take part in, regardless of ability. Digital accessibility is applying this design to the web and applications by making accommodations like adding descriptive alt text to images for users with visual impairments.

  Just because someone has a hearing, vision, speech, mobility, neurological or other impairment doesn’t mean they have any less of a right to shop online, read silly listicles or get into arguments with strangers in the comment section.

  Beyond being the right thing to do, the Fable team shows there’s a strong business case for accessibility. People with disabilities have money to spend, and the accommodations businesses make for them often benefit people without disabilities, too – as anyone who streams with subtitles can attest.

  Despite being a win-win for greater inclusivity and business, much of the web is still inaccessible. WebAIM, a leader in web accessibility, studied a million web pages and found an average of over 55 accessibility errors per page.

  We must all play a more active role in improving the experience of our users with disabilities, and we can start with accessibility auditing and testing.

  An accessibility audit is an evaluation of how usable a site is for people with disabilities. It may be done in-house by an expert on a company’s team or, for better results, a third-party consultant who can give a fully objective audit.

  Auditing might consist of running an automated tool or manually checking your site, PDFs, emails and other materials for compliance with the Web Content Accessibility Guidelines list.

  Accessibility testing is narrower than auditing. It checks how accessibility or its absence looks in action. It can be done after a site, app, email or product is released, but it ideally starts in the development process.

  Testing should be done manually and with automated tools. Manual checks put developers in the position of their users, allowing them to get a better idea of what users are dealing with firsthand. Automated tools can save time and money, but there should always be manual testing in the process.

  Auditing gives teams an idea of where to start with improving accessibility, and testing helps make sure accommodations work as intended.

  Conclusion

  At Matomo, we strive to make the ethical web a reality, starting with web analytics.

  For our users, it means full compliance with stringent policies like GDPR and providing 100% accurate data. For their customers, it’s collecting only the data required to do the job and enabling cookieless configurations to get rid of annoying banners. 

  For both parties, it’s knowing that respect for privacy is one of our foundational values, whether it’s the ability to look under Matomo’s hood and read our open-source code, the option to store data on-premise to minimise the chances of it falling into the wrong hands or one of the other ways that we protect privacy.

  If you weren’t 100% ethical before, it’s never too late to change. You can even bring your Google Analytics data with you.

  Join us in our mission to improve the web. We can’t do it alone ! 

  Try Matomo free for 21 days

  no credit card required

• Open Banking Security 101 : Is open banking safe ?

  3 décembre 2024, par Daniel Crough — Banking and Financial Services

  Open banking is changing the financial industry. Statista reports that open banking transactions hit $57 billion worldwide in 2023 and will likely reach $330 billion by 2027. According to ACI, global real-time payment (RTP) transactions are expected to exceed $575 billion by 2028.

  Open banking is changing how banking works, but is it safe ? And what are the data privacy and security implications for global financial service providers ?

  This post explains the essentials of open banking security and addresses critical data protection and compliance questions. We’ll explore how a privacy-first approach to data analytics can help you meet regulatory requirements, build customer trust and ultimately thrive in the open banking market while offering innovative financial products.

   

  

  

  EU Financial Services Analytics Maturity Report

  Discover trends, strategies, and opportunities to balance compliance and competitiveness.

  Download the report now

  What is open banking ?

  Open banking is a system that connects banks, authorised third-party providers and technology, empowering customers to securely share their financial data with other companies. At the same time, it unlocks access to more innovative and personalised financial products and services like spend management solutions, tailored budgeting apps and more convenient payment gateways. 

  With open banking, consumers have greater choice and control over their financial data, ultimately fostering a more competitive financial industry, supporting technological innovation and paving the way for a more customer-centric financial future.

  Imagine offering your clients a service that analyses spending habits across all accounts — no matter the institution — and automatically finds ways to save them money. Envision providing personalised financial advice tailored to individual needs or enabling customers to apply for a mortgage with just a few taps on their phone. That’s the power of open banking.

  Embracing this technology is an opportunity for banks and fintech companies to build new solutions for customers who are eager for a more transparent and personalised digital experience.

  How is open banking different from traditional banking ?

  In traditional banking, consumers’ financial data is locked away and siloed within each bank’s systems, accessible only to the bank and the account holder. While account holders could manually aggregate and share this data, the process is cumbersome and prone to errors.

  With open banking, users can choose what data to share and with whom, allowing trusted third-party providers to access their financial information directly from the source. 

  

  How does open banking work ?

  The technology that makes open banking possible is the application programming interface (API). Think of banking APIs as digital translators for different software systems ; instead of translating languages, they translate data and code.

  The bank creates and publishes APIs that provide secure access to specific types of customer data, like credit card transaction history and account balances. The open banking API acts like a friendly librarian, ready to assist apps in accessing the information they need in a secure and organised way.

  Third-party providers, like fintech companies, use these APIs to build their applications and services. Some tech companies also act as intermediaries between fintechs and banks to simplify connections to multiple APIs simultaneously.

  For example, banks like BBVA (Spain) and Capital One (USA) offer secure API platforms. Fintechs like Plaid and TrueLayer use those banking APIs as a bridge to users’ financial data. This bridge gives other service providers like Venmo, Robinhood and Coinbase access to customer data, allowing them to offer new payment gateways and investment tools that traditional banks don’t provide.

  Is open banking safe for global financial services ?

  Yes, open banking is designed from the ground up to be safe for global financial services.

  Open banking doesn’t make customer financial data publicly available. Instead, it uses a secure, regulated framework for sharing information. This framework relies on strong security measures and regulatory oversight to protect user data and ensure responsible access by authorised third-party providers.

  In the following sections, we’ll explore the key security features and banking regulations that make this technology safe and reliable.

  Regulatory compliance in open banking

  Regulatory oversight is a cornerstone of open banking security.

  In the UK and the EU, strict regulations govern how companies access and use customer data. The revised Payment Services Directive (PSD2) in Europe mandates strong customer authentication and secure communication, promoting a high level of security for open banking services.

  To offer open banking services, companies must register with their respective regulatory bodies and comply with all applicable data protection laws.

  For example, third-party service providers in the UK must be authorised by the Financial Conduct Authority (FCA) and listed on the Financial Services Register. Depending on the service they provide, they must get an Account Information Service Provider (AISP) or a Payment Initiation Service Provider (PISP) license.

  Similar regulations and registries exist across Europe, enforced by the European National Competent Authority, like BaFin in Germany and the ACPR in France.

  In the United States, open banking providers don’t require a special federal license. However, this will soon change, as the U.S. Consumer Financial Protection Bureau (CFPB) unveiled a series of rules on 22 October 2024 to establish a regulatory framework for open banking.

  These regulations ensure that only trusted providers can participate in the open banking ecosystem. Anyone can check if a company is a trusted provider on public databases like the Regulated Providers registry on openbanking.org.uk. While being registered doesn’t guarantee fair play, it adds a layer of safety for consumers and banks.

  Key open banking security features that make it safe for global financial services

  Open banking is built on a foundation of solid security measures. Let’s explore five key features that make it safe and reliable for financial institutions and their customers.

  

  Strong Customer Authentication (SCA)

  Strong Customer Authentication (SCA) is a security principle that protects against unauthorised access to user financial data. It’s a regulated and legally required form of multi-factor authentication (MFA) within the European Economic Area.

  SCA mandates that users verify their identity using at least two of the following three factors :

  • Something they know (a password, PIN, security question, etc.)
  • Something they have (a mobile phone, a hardware token or a bank card)
  • Something they are (a fingerprint, facial recognition or voice recognition)

  This type of authentication helps reduce the risk of fraud and unauthorised transactions.

  API security

  PSD2 regulations mandate that banks provide open APIs, giving consumers the right to use any third-party service provider for their online banking services. According to McKinsey research, this has led to a surge in API adoption within the banking sector, with the largest banks allocating 14% of their IT budget to APIs. 

  To ensure API security, banks and financial service providers implement several measures, including :

  • API gateways, which act as a central point of control for all API traffic, enforcing security policies and preventing unauthorised access
  • API keys and tokens to authenticate and authorise API requests (the equivalent of a library card for apps)
  • Rate limiting to prevent denial-of-service attacks by limiting the number of requests a third-party application can make within a specific timeframe
  • Regular security audits and penetration testing to identify and address potential vulnerabilities in the API infrastructure

  Data minimisation and purpose limitation

  Data minimisation and purpose limitation are fundamental principles of data protection that contribute significantly to open banking safety.

  Data minimisation means third parties will collect and process only the data necessary to provide their service. Purpose limitation requires them to use the collected data only for its original purpose.

  For example, a budgeting app that helps users track their spending only needs access to transaction history and account balances. It doesn’t need access to the user’s full transaction details, investment portfolio or loan applications.

  Limiting the data collected from individual banks significantly reduces the risk of potential misuse or exposure in a data breach.

  Encryption

  Encryption is a security method that protects data in transit and at rest. It scrambles data into an unreadable format, making it useless to anyone without the decryption key.

  In open banking, encryption protects users’ data as it travels between the bank and the third-party provider’s systems via the API. It also protects data stored on the bank’s and the provider’s servers. Encryption ensures that even if a breach occurs, user data remains confidential.

  Explicit consent

  In open banking, before a third-party provider can access user data, it must first inform the user what data it will pull and why. The customer must then give their explicit consent to the third party collecting and processing that data.

  This transparency and control are essential for building trust and ensuring customers feel safe using third-party services.

  But beyond that, from the bank’s perspective, explicit customer consent is also vital for compliance with GDPR and other data protection regulations. It can also help limit the bank’s liability in case of a data breach.

  Explicit consent goes beyond sharing financial data. It’s also part of new data privacy regulations around tracking user behaviour online. This is where an ethical web analytics solution like Matomo can be invaluable. Matomo fully complies with some of the world’s strictest privacy regulations, like GDPR, lGPD and HIPAA. With Matomo, you get peace of mind knowing you can continue gathering valuable insights to improve your services and user experience while respecting user privacy and adhering to regulations.

  Risks of open banking for global financial services

  While open banking offers significant benefits, it’s crucial to acknowledge the associated risks. Understanding these risks allows financial institutions to implement safeguards and protect themselves and their customers.

  

  Risk of data breaches

  By its nature, open banking is like adding more doors and windows to your house. It’s convenient but also gives burglars more ways to break in.

  Open banking increases what cybersecurity professionals call the “attack surface,” or the number of potential points of vulnerability for hackers to steal financial data.

  Data breaches are a serious threat to banks and financial institutions. According to IBM’s 2024 Cost of a Data Breach Report, each breach costs companies in the US an average of $4.88 million. Therefore, banks and fintechs must prioritise strong security measures and data protection protocols to mitigate these risks.

  Risk of third-party access

  By definition, open banking involves granting third-party providers access to customer financial information. This introduces a level of risk outside the bank’s direct control.

  Financial institutions must carefully vet third-party providers, ensuring they meet stringent security standards and comply with all relevant data protection regulations.

  Risk of user account takeover

  Open banking can increase the risk of user account takeover if adequate security measures are not in place. For example, if a malicious third-party provider gains unauthorised access to a user’s bank login details, they could take control of the user’s account and make fraudulent bank transactions.

  A proactive approach to security, continuous monitoring and a commitment to evolving best practices and security protocols are crucial for navigating the open banking landscape.

  Open banking and data analytics : A balancing act for financial institutions

  The additional data exchanged through open banking unveils deeper insights into customer behaviour and preferences. This data can fuel innovation, enabling the development of personalised products and services and improved risk management strategies.

  However, using this data responsibly requires a careful balancing act.

  Too much reliance on data without proper safeguards can erode trust and invite regulatory issues. The opposite can stifle innovation and limit the technology’s potential.

  Matomo Analytics derisks web and app environments by giving full control over what data is tracked and how it is stored. The platform prioritises user data privacy and security while providing valuable data and analytics that will be familiar to anyone who has used Google Analytics.

  Open banking, data privacy and AI

  The future of open banking is entangled with emerging technologies like artificial intelligence (AI) and machine learning. These technologies significantly enhance open banking analytics, personalise services, and automate financial tasks.

  Several banks, credit unions and financial service providers are already exploring AI’s potential in open banking. For example, HSBC developed the AI-enabled FX Prompt in 2023 to improve forex trading. The bank processed 823 million client API calls, many of which were open banking.

  However, using AI in open banking raises important data privacy considerations. As the American Bar Association highlights, balancing personalisation with responsible AI use is crucial for open banking’s future. Financial institutions must ensure that AI-driven solutions are developed and implemented ethically, respecting customer privacy and data protection.

  Conclusion

  Open banking presents a significant opportunity for innovation and growth in the financial services industry. While it’s important to acknowledge the associated risks, security measures like explicit customer consent, encryption and regulatory frameworks make open banking a safe and reliable system for banks and their clients.

  Financial service providers must adopt a multifaceted approach to data privacy, implementing privacy-centred solutions across all aspects of their business, from open banking to online services and web analytics.

  By prioritising data privacy and security, financial institutions can build customer trust, unlock the full potential of open banking and thrive in today’s changing financial environment.